Skip to content
COEUS
Install

PowerShell Decoder & Script Inspector

Decode PowerShell EncodedCommand input and inspect bounded static evidence without executing it.

Processed in your browser. Your input is not uploaded.

0 / 524,288 bytes

The supplied text is not uploaded or executed.

How to use it

  1. 1

    Paste one command or script

    Add a PowerShell command line, script block or EncodedCommand value up to 512 KiB. It stays in page memory and is not uploaded.

  2. 2

    Review supported static transforms

    Follow each bounded decoding step, then inspect the inert derived text, neutral syntax observations and extracted indicators.

  3. 3

    Continue with one selected lead

    Copy local evidence or explicitly hand one eligible URL, domain, IP, hash, file path or registry key to Coeus.

What the results mean

Decoded text is not runtime behavior.

The tool does not execute PowerShell, resolve dynamic values, verify syntax or prove what a command would do in a particular environment.

Static decoding is deliberately bounded.

Only documented literal Base64, text, join, character-array and gzip forms are considered. Dynamic expressions, XOR, encryption and archives remain unresolved evidence.

Observed syntax is not a verdict.

Encoding, dynamic evaluation and network- or process-capable commands can be legitimate. The page performs no reputation lookup or maliciousness assessment.

Related tools

Keep working with the same local-first toolkit.

IOC ExtractorFind, deduplicate and review identifiers in text.File Hash InspectorCheck a local file's hashes, byte signature, strings and investigation leads.